Bump distroless-iptables to v0.3.1 and Go to 1.21

Also bump bash-static to the version from Debian 12 (Bookworm), since
distroless-iptables v0.3.1 is now based on Debian 12, and bash-static
from Debian 11 crashes with SIGSEGV there.

Makefile

@@ -30,7 +30,7 @@ ALL_PLATFORMS ?= linux/amd64 linux/arm linux/arm64 linux/ppc64le linux/s390x
 
 # The "FROM" part of the Dockerfile.  This should be a manifest-list which
 # supports all of the platforms listed in ALL_PLATFORMS.
-BASE_IMAGE ?= registry.k8s.io/build-image/distroless-iptables:v0.2.5
+BASE_IMAGE ?= registry.k8s.io/build-image/distroless-iptables:v0.3.1
 
 # Where to push the docker images.
 REGISTRY ?= gcr.io/gke-release-staging
@@ -60,7 +60,7 @@ ARCH := $(if $(GOARCH),$(GOARCH),$(shell go env GOARCH))
 
 TAG := $(VERSION)__$(OS)_$(ARCH)
 
-GO_VERSION := 1.20
+GO_VERSION := 1.21
 BUILD_IMAGE := golang:$(GO_VERSION)-alpine
 
 BIN_EXTENSION :=

scripts/Dockerfile.in

@@ -63,7 +63,7 @@ RUN /alpine-extractor.sh musl openssl-dev openssl-libs-static linux-headers
 
 ## The bash container fetches bash-static (to be used as bash) from Debian repo.
 
-FROM debian:11.4 AS bash
+FROM debian:bookworm-slim AS bash
 
 RUN apt-get update
 RUN apt-get install -y --no-install-recommends --no-install-suggests bash-static

scripts/Makefile

@@ -30,7 +30,7 @@ ALL_PLATFORMS ?= linux/amd64 linux/arm linux/arm64 linux/ppc64le linux/s390x
 
 # The "FROM" part of the Dockerfile.  This should be a manifest-list which
 # supports all of the platforms listed in ALL_PLATFORMS.
-BASE_IMAGE ?= registry.k8s.io/build-image/distroless-iptables:v0.2.5
+BASE_IMAGE ?= registry.k8s.io/build-image/distroless-iptables:v0.3.1
 
 # Where to push the docker images.
 REGISTRY ?= gcr.io/gke-release-staging
@@ -70,7 +70,7 @@ ARCH := $(if $(GOARCH),$(GOARCH),$(shell go env GOARCH))
 
 TAG := $(VERSION)__$(OS)_$(ARCH)
 
-GO_VERSION := 1.20
+GO_VERSION := 1.21
 BUILD_IMAGE := golang:$(GO_VERSION)-alpine
 
 BIN_EXTENSION :=